p PatchFirst

PatchFirst · Latest vulnerabilities

api-platform/graphql vulnerabilities

Vulnerabilities published for api-platform/graphql in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2025-31485

    High · CVSS 7.5EPSS 0.63%Fix available

    GraphQL grant on a property might be cached with different objects

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.

    api-platform/graphql api-platform/graphql api-platform/graphqlPHP
    • Update to 3.4.17
    • Update to 4.0.22
    • Update to 4.1.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2025-31481

    High · CVSS 7.5EPSS 0.47%Fix available

    GraphQL query operations security can be bypassed

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.

    api-platform/graphql api-platform/graphql api-platform/graphqlPHP
    • Update to 3.4.17
    • Update to 4.0.22
    • Update to 4.1.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →